Basilisk

Drawn to systems. Leaving only signals.
Built in silence. Known through traces.

[Basilisk @JhoneSnoww]

It looks more like a purpose-built operator toolkit optimized for hands-on access and stealth. Defenders should focus on execution chains,local IPC,persistence changes, unusual RDP activity, and post-compromise user interaction instead of relying only on classic beacon detection.

[Basilisk @JhoneSnoww]

Russian-origin CTRL toolkit is a strong example of stealth-first intrusion design. It reportedly uses malicious .LNK files disguised as private key folders to trigger a multi-stage, in-memory execution chain built around .NET payloads.

[Basilisk @JhoneSnoww]

It also uses a WPF-based Windows Hello phishing prompt to capture PINs and check them against the real system flow. This is not just generic commodity malware behavior.

[Basilisk @JhoneSnoww]

Why this matters”
A file can be a valid WAV container and still carry content that does not statistically resemble normal audio. Defenders should inspect the payload region, not just the file type label or header.

[Basilisk @JhoneSnoww]

It can miss abuse that reuses what is already in the process. Trusting the process is not enough. Defenders need better visibility into thread context changes, odd control-flow transitions, unexpected RWX usage, and execution that does not match normal process behavior.

[Basilisk @JhoneSnoww]

Living off the Process” shows how attackers try to reduce detection by abusing what a trusted process already has: existing executable memory, existing threads, and existing code paths.

[Basilisk @JhoneSnoww]

The real defensive takeaway is not the novelty of the technique, but the shift in detection logic it demands. If security tooling focuses only on classic signals like fresh allocations, WriteProcessMemory, or obvious DLL injection,

[Basilisk @JhoneSnoww]

The defensive lesson is clear: validate behavior, token context, call chains, and telemetry depth, not just the visible process tree.

[Basilisk @JhoneSnoww]

Parent PID spoofing is a reminder that process lineage alone is not trust.Attackers can make a malicious process appear as if it was spawned by a legitimate parent, weakening heuristic detection and confusing analysts who rely too heavily on parent-child relationships.

[Basilisk @JhoneSnoww]

Another reminder that even preview updates can create real operational risk, especially when they touch core platform reliability.

[Basilisk @JhoneSnoww]

Microsoft has paused KB5079391 for Windows 11 after installation failures hit some devices with error 0x80073712. This was a non-security preview update for 24H2 and 25H2, but the rollout is now temporarily limited while Microsoft investigates.

[Basilisk @JhoneSnoww]

The real signal is the behavior chain: admin context → privilege prep → servicing-related trigger → process/thread discovery → impersonation → access to protected resources
Defenders should not focus only on the tool. They should focus on the sequence.

[Basilisk @JhoneSnoww]

TrustedInstaller abuse is dangerous because it does not always look like a loud privilege escalation path.

[Basilisk @JhoneSnoww]

The lesson is simple: do not run commands from social media videos, do not trust activation tutorials, and never enter a crypto seed phrase into any popup.
https://t.co/uTBTORj6d3

[Basilisk @JhoneSnoww]

TikTok is becoming a malware delivery channel, not just a content platform. Attackers are posting fake tutorial videos that trick users into opening Win + R, launching PowerShell, and running malicious commands themselves.

[Basilisk @JhoneSnoww]

That is why ClickFix is so effective: the victim ends up triggering the infection. This is especially dangerous because malware like Vidar and StealC can be delivered with less disk exposure, giving defenders fewer chances to catch it early.

[Marlene Mhangami @marlene_zw]

Read this beautiful article today❤️ Resonates a lot for me!

"...much of how we design learning systems (and increasingly how we talk about AI!) quietly assumes that the human in the loop is a variable to optimize, a source of friction to reduce, or worse, something to replace."

[RT @RT_com]

Handala hacker group claims FBI chief Kash Patel was HACKED

Posts alleged 'top secret security clearance — awkward close-ups and unflattering shots of the FBI Director

'The so-called impenetrable systems of the FBI were brought to their knees within hours by our team'